Spot the bug in Hono admin middleware

from Hono
Hono 4.13.5 / Node 24 / TypeScript 6 intermediate 4 min 1 issue to find

Why is `/admin/report` not protected by this generated middleware?

TypeScript
import { Hono } from 'hono'

const app = new Hono()

app.get('/admin/report', (c) => {
  return c.json({ revenue: 4200 })
})

app.use('/admin/*', async (c, next) => {
  if (c.req.header('authorization') !== 'Bearer valid') {
    return c.json({ error: 'Unauthorized' }, 401)
  }
  await next()
})
Open in playground
Report an error